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DETAILED ACTION 
Response to Amendment 
This office action is in response to amendment filed on 03/23/05. Original application 
contained Claims 1-12. The amendment filed on 03/23/05 have been entered and made of 
record. Therefore, presently pending claims are 1-12. 

Response to Arguments 

Applicant's arguments filed 03/23/05 have been fully considered but they are not 
persuasive because of following reasons. 

The affidavit filed on 03/23/2005 under 37 CFR 1.131 has been considered but is 
ineffective to overcome the Jordan (20020073323) reference. 

The evidence submitted is insufficient to establish a conception of the invention prior to 
the effective date of the July 14, 2000 reference. While conception is the mental part of the 
inventive act, it must be capable of proof, such as by demonstrative evidence or by a complete 
disclosure to another. Conception is more than a vague idea of how to solve a problem. The 
requisite means themselves and their interaction must also be comprehended. See Mergenthaler 
v. Scudder, 1897 CD. 724, 81 O.G. 1417 (D.C Cir. 1897). The evidence provided does not 
disclose step of "writing the results of said interpretation," as claimed in claims 1. In reference 
to claims 1 and 7, although the evidence discloses a Macro interpreter, the evidence does not 
disclose interpreting code. In reference to claim 6, the evidence does not disclose a computer 
readable medium. In reference to claim 7, the evidence does not disclose "result evaluator" and 
"a reporter." 
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The evidence submitted is insufficient to establish diligence from a date prior to the date 
of reduction to practice of the Jordan reference to either a constructive reduction to practice or an 
actual reduction to practice. 

What is meant by diligence is brought out in Christie v. Seybold, 1893 CD. 515, 64 
O.G. 1650 (6th Cir. 1893). In patent law, an inventor is either diligent at a given time or 
he is not diligent; there are no degrees of diligence. An applicant may be diligent within 
the meaning of the patent law when he or she is doing nothing, if his or her lack of 
activity is excused. Note, however, that the record must set forth an explanation or excuse 
for the inactivity; the USPTO or courts will not speculate on possible explanations for 
delay or inactivity. See In re Nelson, 420 F.2d 1079, 164 USPQ 458 (CCPA 1970). 
Diligence must be judged on the basis of the particular facts in each case. See MPEP § 
2138.06 for a detailed discussion of the diligence requirement for proving prior invention. 
Under 37 CFR 1 . 13 1, the critical period in which diligence must be shown begins just 
prior to the effective date of the reference or activity and ends with the date of a 
reduction to practice, either actual or constructive (i.e., filing a United States patent 
application). Note, therefore, that only diligence before reduction to practice is a material 
consideration. The "lapse of time between the completion or reduction to practice of an 
invention and the filing of an application thereon" is not relevant to an affidavit or 
declaration under 37 CFR 1.131. See Ex parte Mere, 75 USPQ 296 (Bd. App. 1947). 
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Applicant should provide detailed description from conception date (December 15, 1999) to the 
filing date. Applicant should also see MPEP 2138.06 and 2138.06. 

Accordingly, rejections for claims 1-12 are respectfully maintained. 

Claim Rejections -35 USC §103 

Claims 1-4 and 6 are rejected under 35 U.S.C. 103(a) as being unpatentable over Jordan 
(2002/0073323 Al). 

In reference to claim 1 and 6, Jordan discloses a system and method for detecting 
computer viruses that attempt to gain access to restricted computer (abstract). The method 
includes writing the results and scanning the results for the presence of proscribed code (page 3 
paragraph 0028). 

Although Jordan does not expressly disclose interpreting code, Jordan discloses an 
emulator that emulates the executable code (page 3 paragraph 0028). 

At the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to use the emulator to perform the function of the interpreter. One of ordinary 
skill in the art would have been motivated to do this because it is desirable that the malicious 
code is not executed and the interpreter and the emulator do not execute the code, instead they 
simulate the execution of the code. 

In reference to claim 2, wherein the step of scanning further comprising a first scanning 
step for the presence of code of interest. Jordan discloses detecting modification of memory 
(page 3 paragraph 0027) and therefore code of interest. 

In reference to claim 3, wherein the first scanning step for the presence of code of interest 
further comprises scanning for a file open command or a file modify command. Jordan discloses 
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detecting modification of memory (page 3 paragraph 0027). Modifying a file will modify 
memory. 

In reference to claim 4, wherein the step of scanning further comprising a second 
scanning step for the presence of proscribed code of interest. Jordan discloses detecting 
modification of memory (page 3 paragraph 0027), the access of memory includes accessing 
restricted computer system resources; this is the presence of proscribed code. 

Claims 5, 7-12 are rejected under 35 U.S.C. 103(a) as being unpatentable over Jordan as 
applied to claim 1, and 4 respectfully above, and further in view of Shieh et al (5,278,901). 

In reference to claim 7, is rejected as in claim 1 a system and method for detecting 
computer viruses that attempt to gain access to restricted computer (abstract). The method 
includes interpreting code (emulator) that emulates the executable code (page 3 paragraph 0028), 
a reporter and a results evaluator (page 3 paragraph 0028), whereby the file is interpreted by the 
emulator and results generated those results sent to the evaluator (detector) that determines if 
malicious code is present and then the results are reported. However Jordan does not expressly 
disclose a pattern analyzer. 

However Shieh discloses a pattern-oriented system and method of intrusion detection 
(column 4 lines 9-22). The patter-oriented system is used to detect virus propagation (xolumn 16 
lines 31 to column 17 line 30); therefore the pattern analyzer reviews patterns for the presence of 
proscribed code. 

At the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to add a pattern analyzer for detection for intrusion detection as in the system by 
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Shieh in the system of Jordan. One of ordinary skill in the art would have been motivated to do 
this because patterns are a simple way of defining deviation from the normal operation of the 
system. 

In reference to claim 5, Jordan does not expressly disclose a system wherein the second 
scanning step for the presence of proscribed code of interest further comprises scanning for viral 
code or viral patterns. 

However Shieh discloses a pattern-oriented system and method of intrusion detection 
(column 4 lines 9-22). 

At the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to use pattern detection for intrusion detection as in the system by Shieh in the 
system of Jordan. One of ordinary skill in the art would have been motivated to do this because 
patterns are a simple way of defining deviation from the normal operation of the system. . 

In reference to claim 8, wherein the step of scanning further comprising a first scanning 
step for the presence of code of interest. Jordan discloses detecting modification of memory 
(page 3 paragraph 0027) and therefore code of interest. 

In reference to claim 9, wherein the first scanning step for the presence of code of interest 
further comprises scanning for a file open command or a file modify command. Jordan discloses 
detecting modification of memory (page 3 paragraph 0027). Modifying a file will modify 
memory. 

In reference to claims 10-12, Jordan does not expressly disclose the pattern analyzer 
further reviews said code for the presence of code of interest. 
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Shieh dislcoses the pattern analyzer reviews code for the presence of problems, or code 
of interest (column 4 line 60 to column 5 line 11). 

At the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to use pattern detection for code of interest as in the system by Shieh in the system 
of Jordan. One of ordinary skill in the art would have been motivated to do this because patterns 
are a simple way of defining deviation from the normal operation of the system. 

Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 . 136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Paula W. Klimach whose telephone number is (571) 272-3854. 
The examiner can normally be reached on Mon to Thr 9:30 a.m to 5:30 p.m. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on (571) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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